BACKUP /RECOVERY SYSTEM AND 
METHODS FOR PROTECTING A COMPUTER SYSTEM 



BACKGROUND OF THE INVENTION 

1. Field of the Invention 

t The present invention relates to a backup/recovery 
technique for a computer system, and more particularly to a 
method for protecting a computer system with a backup/recovery 
system. 

2 . Description of Prior Art 

The protection for the computer system is an important issue 
for a computer user at present. Chain mails for the spread of 
virus by way of Internet are increasingly overabundance in virtue 
of vigorous development of network. Modern people get used to 
E-mails (electronic mails) as the connecting interface between 
human beings. Afterwards, they often receive greetings and 
messages sen dt out from others, as well as the annoying opama spam 
Aad Further, it is impossible to guard against viruses smuggled 
by concealing in between the mails. 

Computer viruses are buried or hidden in another program. 
Once the program is executed, the virus is activated and attaches 
itself to other programs in the system. Nowadays, viruses are 
frequently spread by the smuggling with files in a predetermined 
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form, such as*. EXE, *.DOC, and *. ZIP form attached to the e-mails 
When the user is ignorant of what happened and operates the 
attached files, the computer will be affected by poison. Viruses 
will send themselves to the entire name mailing list of the users' 
record of communication. If the users relax their vigilance and 
operate the virus -smuggled files, there will be a chain-infected 
reaction that causes the disaster worldwide. 
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Moreover, for the PC (personal computer) users, they will 
risk interconnecting of computers into networks. I n gqoc o f the 
viruses infect sed theisr users' computers, viruses usually 
destroy the files throughout the user' s disks and all computer 
files may be deleted that lose the essential data in the twinkling 
of an eye and cause the computer system operates ion out of order. 
If files in the operating system filco have been infected and 
destroyed, the operating system, such as Windows, cannot be 
rebooted. The more serious effect ouch is that the computer system 
needs to be ^e— setup again . Hence, there is a need for eliminating 
viruses from computers and networks. 

Conventionally, a used backup/recovery software, although 
having the backup/recovery function, it is capable of executing 
the backup program for backing up data, also of executing the 
recovery program for restoring the data to the hard disk ( HP) , 
in order to protect the HP with the function of return ing to fefee 
a normal state. Nevertheless, not only the HP is not thoroughly 
protected thoroughly , but also the backup/recovery r eopera tion 
always wastes the user a long lots of time. 

For instance, the convent ional a — prior Ghoot — backup /recovery 
software , such as the Ghost software developed rcacarchcd by 
Symantec Corporat ion in U.S.A. , ita backup/recovery action needs 
the network administrator to operate the operating system (OS) 



before he/she manually operates the — Choot — a backup/ recovery 
progra m manually . The Ghost software includes a backup program 

to backe up all data stored in ^he selected hard 

di ale/ part it ion /hard disk to a file — totally . In addition , it 
further includes aed Ghoot recovery program to restores the data 
from the file to the selected hard diok/ partition /hard disk . 
Prior to backing up the data, the Ghost software stops all other 
tasks in the computer. All running applications are closed before 
the backup procedure. It then 4rS — a — oinglc — taok procedure — fee- 
creates a— the backup file, with Choot that the backed-up data, 
in a single task procedure, all of other taoko ohould stop ahead, 
This backup procedure takes 

and it opendo a period of time about 8 minutes per Gigabyte / Gb , 
in general . Since Dcoidco , — owing to the Ghost software backs up 
all the valid data stored in the hard disk, the apace of the hard 
diok for backing up data itself backed up occupied by the Ghost 
software occupies an ire-ex tr erne ly large space in the hard disk . 
The All data provided currently that being used ttr- by the file 
system of the operating system (OS) will be backed up the belonged 
area into the backup file aboolutcly , nevertheless whether such 
related data irfc- has been changed or not aftcrwardo in the past , 
thereby occupy ing cauoing a great amount of space in the hard 
disk being occupied . 

Further, some presently available anothcr prior 




backup/recovery software, such as the Goback software developed — 
designed by Aardaptec Corporation in U.S.A. , 4r&— operates the its 
recovery action — program without the need of operating the 
operating system (OS) in advance. While The gyatcm io indicated 
to initiat ing e the a recovery operation, and then the Goback 
software recoveries the hard disk to a_selected status. When the 
computer system is destroyed, the re opera tion of restoring the 
hard disk disk — f ilea also needs the network administrator to 
implement operate the recovery program manually. 

Obviously, when the computer system is surfing the web or 
receiving electronic mails accesses by multiple the users-, the 
virus wcouldiii be easily infected the user's hard disks. The 
virus will further then break out that causes the accidental 
damage of the computer system^ damaged unexpectedly Mor eover, if 
the virus is successful, more — acrioua — effec t s — ouch — ae — the 
computer system cannot be booted from either the hard disk or the 
floppy . Nevertheless, the convent ional uocd backup/recovery 
software is unable to effectively distinguish the possible danger 
of receiving data from the Internet effectively , not to mention 
the fact that it is incapable of backing up data 
promptly immediately . 

Conversely, various convent ional prior art devices have been 
proposed for the detection of virus intrusions on the computer 
system. For example, the Thc InterScan VirusWall developed 
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produced by Trend Micro Corporation, it provides Internet gateway- 
protection against viruses and malicious code. The detection is 
for all SMTP, HTTP, and FTP Internet traffic at the gateway and 
blocks malicious mobile code at the gateway. It can be configured 
to respond to virus detection and security violation incidents 
in three ways, such as alerts the system administrator, just 
deletes the infected file or permits the user to download the file 
under 

certain controlled conditions, optionally isolates the infected 
file for later treatment. 

The previous anti -virus software may provide Internet 
real-time virus detection during surfing the web and blockage of 
viruses included with electronic mails, however, the 
backup/recovery technique is not available in such anti-virus 
software . This results in a harm of the hard disk for a computer 
system , in a situation of the undefined viruses . As described 
above, the anti-virus software cannot backe up and / o r— r e c ove r 
data in the hard disk retrievco data . Hence, in case of contingency, 
the computer system is de s t roy ed damagc d , the disks cannot return 
to the normal state immcdiatcly . The demand of real-time 
backup /recovery for the user cannot be oatiaficd served well . 

Accordingly, because of the presently anti -virus software 
doesn't contains without backup/ recovery function and current 
other — backup/recovery software products cannot recognize the 
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possible danger of receiving data from the Internet to protect 
the computer system ao woll. ^ t^here is a need in the art to 
provide a backup/ recovery software for protecting a computer 
syste m much more efficiently . 

The present invention overcomes the limitations and 
shortcomings of the prior art with systems and methods for 
protecting a computer system with files automatically back ed up 
to the data storage device, such as a hard disk automatically 
prior to downloading data to the end-users ' computers . It will 
be appreciated that the system and method of the present invention 
may provide computer system protection from viruses introduced 
by data downloaded from the largely unregulated network. 

SUMMARY OF THE INVENTION 
Accordingly, an object of the present invention is to 
provide a backup/recovery system and methods, which can be used 
in a computer system to securely backe up and reliably retrieves 
data. The improvement is remarkable for the data storage mcano 
device while its data is under whole automatic protection from 
viruses . 

To achieve the above and other objects, this invention 
applies a detecting module in the backup/recovery system to 
monitor a predetermined data mcooagc to be downloaded to the 
computer system. When a predetermined data mcooagc is arrived to 



the computer syste m rcccivcd , the detecting module determines 
whether there is a predetermined harmful data contained in the 
predetermined data mcooagc . If there is a predetermined harmful 
data contained therein, the backup/recovery system backs up data 
automatically prior to downloading the predetermined ouch data, 
so as to protect the computer system. 

One aspect of the present invention involves a 
backup/recovery system for detecting and backing up data 
immediately. The backup/ recovery system is installed in a 
computer system. The computer system includes an application 
layer, which coupled to an interface. The backup/ recovery system 
comprises a detecting module, located within the computer system, 
for monitoring a predetermined mcooagc data . The detecting module 
retrieves the predetermined data mcooagc , in order to determine 
whether there is a predetermined harmful data contained therein 
for judging the backup/recovery system to backup data or not. 
The interface implements a predetermined procedure thereafter 
and the application layer involves reading — accessing the 
predetermined data mcooagc . 

Another aspect of the present invention involves a method 
for protecting a computer system. The method comprises three 
steps. First, the backup/recovery system retrieves a 
predetermined data mcoaagc to be downloaded to the computer 
system. Secondly, upon retrieval of a predetermined data mcooagc 
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to be downloaded, determines whether a predetermined harmful 
data is contained in the predetermined data mcaoagc . If there is 
predetermined harmful data is-contained therein , the data stored 
in the computer system is backed up eventually, in order to enable 
the computer system to return the data storage device mcano to 
a prcccding previous state**e while at the time the viruses infect 
the data storage device moano . 

Further aspect of the present invention involves a method 
for protecting a computer system with a backup/recovery system. 
The computer system includes an application layer coupled to an 
interface. The method comprises several steps. First, the 
backup/recovery system installs in the computer system. The 
backup/recovery system comprises a detecting module for 
monitoring a predetermined mcooagc — data located within the 
computer system. Secondly, the detecting module retrieves the 
predetermined data mcaoagc to be downloaded to the computer 
system. Upon retrieval of a predetermined data mcaoagc to be 
downloaded, determines whether a predetermined harmful data is 
contained in the predetermined data mcooagc . If the is- 
predetermined harmful data is contained, the data stored in the 
computer system is backed up. Then, the interface implements a 
predetermined procedure. Eventually, the application layer is 
indicated to read access the predetermined message. 

In the preferred embodiment of the invention, the 
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backup/recovery system is coupled to a network device. The 
network device ^e can be coupled to at least one client device 
by a communicatione link. The network device can be jre coupled 
to a server device. The server device is capable of controlling 
the client device's backup/recovery conduct operation remotely 
and immediately. The network device comprises a network means, 
comprising one or more of the group consisting of a LAN, WAN, 
Internet, Intranet, Extranet and wireless network. The network 
device comprises a communication means, comprising one or more 
of the group consisting of electronic mail, TCP/IP sockets, RPC, 
HTTP, and HOP. The predetermined harmful data comprises a file 
which is of a type that can contain viruses in a predetermined 
form , comprising one or more of the group conoioting of such as 
-*.EXE, -*-.DOC, and -*-.ZIP extension file form . 

It is to be understood that both the foregoing general 
description and the following detailed description are exemplary, 
and are intended to provide further explanation of the invention 
as claimed. 

BRIEF DESCRIPTION OF THE DRAWINGS 
The above-mentioned objects and other objects and features 
of this invention and manner of attaining them will become 
apparent, and the invention itself will be understood by 
reference to the following description of the preferred 
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embodiments of the invention taken in conjunction with the 
accompanying drawings, wherein: 

FIG. 1 illustrates parts of a computer system with a 
backup/recovery system as per an embodiment of the invention; 

FIG. 2 illustrates a flowchart of the computer system with 
a backup/recovery system as per an embodiment of the invention; 
and 

FIG. 3 illustrates a schematic diagram of the hard disk 
return to a otatc of the prcccding previous state for protecting 
the computer system as per an embodiment of the invention. 



DESCRIPTION OF THE PREFERRED EMBODIMENT 
Reference will now be made in detail to the present 
preferred embodiments of the invention, examples of which are 
illustrated in the accompanying drawings. Wherever possible, the 
same reference numbers are used in the drawings and the 
description to refer to the same or like parts. 

The present invention contemplates a backup/recovery 
system to provide protection for the computer system by way of 
a detecting module of the backup /recovery system. The real—time 
backup/recovery system adopts a technique for detecting network 
data to be downloaded to the computer system, such as data 
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retrieved from an Internet content server in response to a 
browser request, which can automatically backup any file 
alteration to the hard disk. Here is referred to the data to be 
downloaded, it being understood that the invention is capable 
of use in various other combinations and environments and is 
capable of changes or modifications within the scope of the 
inventive concepts as expressed hereunder. 

The preferred embodiment of the present invention provides 
a backup/recovery system installed in the computer system. The 
computer system comprises at least an application layer, which 
coupled to an interface. The application layer is used for 
operating a predetermined application program. The 
backup/recovery system comprises a detecting module, located 
within the computer system, for monitoring a predetermined 
mcaaagc data . 

When the predetermined data mcoaagc is received, the 
detecting module determines whether there is a predetermined 
harmful data contained in the predetermined data mQooagc . If 
there is a predetermined harmful data contained therein, the 
backup/recovery system backs up data stored in the hard disk , 
and the interface implements a predetermined procedure 
thereafter, so that application layer can read — access the 
predetermined mcaaagc data . 

With reference to FIG. 1, according to an embodiment of the 
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present invention a backup/recovery system may recognize the 
possible danger of receiving data from network effectively, and 
may create a res tore rcot oration point immediately to backup data 
as well . 

The computer system includes an application layer 2 and a 
driver layer 4 . The application layer 2 is used for operating 
a predetermined application program, and the driver layer 4 is 
used for operating a predetermined driver program. The 
application layer 2 is coupled to an interface, which installs 
the corresponding protocol module stored therein at the time of 
initiating . 

The application layer 2 is a layer for operating the 
application program. The application layer 2 has an Internet 
Application interface 20. All of the network application 
programs, such as Internet Explorer, Outlook Express, FTP 
utilities and TELNET utilities, are operated at the application 
layer 2 . 

The driver layer 4 is a layer for operating the driver 
program. All of the network driver programs are operated at the 
driver layer 4 . The driver layer 4 provides the network access 
service for the application program, and accesses LAN (local area 
network) and distributed system (Internet) 6 through the network 
interface card or other network system. The driver layer 4 has 
a network driver interface 40. 
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The backup/recovery system may couple to a network device. 
The network device is coupled to at least one client device by 
a communications link. The network device is coupled to a server 
device. The server device is capable of controlling the client 



immediately. The network device comprises a network means, 
comprising one or more of the group consisting of a LAN, WAN, 
Internet, Intranet, Extranet and wireless network. The network 
device comprises a communication means, comprising one or more 
of the group consisting of electronic mail, TCP/IP sockets, RPC, 
HTTP, and HOP. 

The backup/ recovery system comprises a detecting module 42, 
a network monitor driver. The detecting module 42 may get into 
the application layer 2 or the driver layer 4 upon the 
backup/recovery system is installed in the computer system. 
While in the preferred embodiment of the present invention, the 
detecting module 42 of the backup/ recovery system gets into the 
driver layer 4 for monitoring a predetermined mcoaagc data to 
be downloaded to the computer system. 

When the predetermined data message — is received, the 
detecting module 42 retrieves the data mcooagc . The predetermined 
data mcooagc is coming from the behavior of downloading from the 
network or the receiving electronic mails via Outlook Express, 
comprising HTTP pages, E-mails, downloading files and so forth. 



device' s backup/ recovery 




remotely and 
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Furthermore, the detecting module 4 2 determines whether 
there is a predetermined harmful data contained in the 
predetermined mcooago data , in order to judge whether the 
backup/recovery system creates a res tore rcot oration point to 
backup data stored in the hard disk . The predetermined harmful 
data includes the possible harmful data, which comprises a file 
in a predetermined form, comprising one or more of the group 
consisting of . EXE , -^.DOC, and ^.ZIP extension file form . Other 
types of files are included as well. 

That is, the detecting module 42 will retrieve all 
downloading data the application layer 2 call on the network a**d 
or the receiving electronic mails via Outlook Express. The 
detecting module 42 monitors the data to be downloaded to the 
computer system. If there is a predetermined harmful data 
contained therein, the backup/recovery system may create a 
res tore rcot oration point immediately to backup data as well 
prior to downloading data to the end-users ' computers . 

Thereafter, the detecting module 42 oondo transfers the 
predetermined mcaaagc data to the computer system. After the 
interface implements a predetermined procedure, such as dealing 
with the protocol module and the uniform format handling for the 
rccc arr ived data, the application layer 2 is informed to road 
access the predetermined data mcaaago . 

Thereupon, if the rc c c arr ived data cause damage to the 
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computer system, it is capable of returning the storage device 
to the prcccding previous condition state immediately . 

Accordingly, the backup/recovery system as per — the 
preferred embodiment of the present invention installed in the 
computer system may monitor all information from the network. 
Once it detects the downloading conduct — operation or the 
electronic mails received by Outlook Express, it creates a 
re store rcot oration point immediately with the valid data. 

The detecting module 42 monitors all information from the 
network entirely. Therefore, if viruses and malicious code 
smuggling with the downloading data or the receiving electronic 
mails that activated and caused the system crash, the system 
still can return to the normal state. 

The present invention meditates a method for protecting a 
computer system. The method comprises three steps. First, the 
backup/recovery system retrieves a predetermined mcosagc data 
to be downloaded to the computer system. Secondly, upon retrieval 
of a predetermined moo page data to be downloaded, determines 
whether a predetermined harmful data is contained in the 
predetermined data mcooagc . If the is-predetermined harmful data 
is contained, the data stored in the computer system is backed 
up eventually, in order to enable the computer system to return 
the data storage device mcano to a prcccding previous stateus 
while at the time the viruses infect the storage device mcans . 
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In the preferred embodiment of the invention, the present 
invention contemplates a method for protecting a computer system 
with a backup/recovery system. The computer system includes an 
application layer coupled to an interface. First, the 
backup /recovery system installs in the computer system. The 
backup /recovery system comprises a detecting module for 
monitoring a predetermined data mcsoagc arrived to locatcd within 
the computer system. Secondly, the detecting module retrieves 
the predetermined data mcooagc to be downloaded to the computer 
system. Upon retrieval of a predetermined data mcooagc to be 
downloaded, determines whether a predetermined harmful data is 
contained in the predetermined data mcooagc . If the 4rB 
predetermined harmful data is contained, the data stored in the 
computer system is backed up. Then, the interface implements a 
predetermined procedure. Eventually, the application layer is 
indicated to read access the predetermined data mcooagc . 

FIG. 2 illustrates a flowchart of the computer system with 
a backup/recovery system as per an embodiment of the invention. 
First of all, Step S10 is to monitor the mcooagc data to be 
downloaded to the computer system. Upon the data mcooagc is 
arrived; the detecting module 42 retrieves the data mcooagc and 
determines the data mcooagc in advance. 

Step S30, a second step, is to ascertain by the detecting 
module 42, whether the network data mcooagc is downloaded to the 
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computer system. The detecting module 42 analyzes the contents 
contained in the mcooagc data and determines whether the 
mcooagc data is the predetermined mcooagc data the users applied 
required to be downloaded. If not, then goes to Step S90, and 
oendo transfers the mcooagc data to the upper layer. 

If yes, then goes to Step S50 . The predetermined mcooagc data 
is coming from the behavior of downloading from the network or 
the receiving electronic mails via Outlook Express, comprising 
HTTP pages, E-mails, downloading files and so forth. 

Step S50, a third step, is to determine further whether the 
mcooagc data contains a predetermined harmful- data by the 
detecting module 42. For example, the possible harmful data may 
comprise a file in a predetermined form, comprising one or more 
of the group consisting of *-.EXE, ^.DOC, and -^.ZIP form. If not, 
such data like TXT, bitmap, then goes to Step S90 either, and 
the detecting module 42 oendo transfers the mcooagc data to the 
upper layer. 

If yes, then goes to Step S70. The backup/recovery system 
creates a re store rcot oration point automatically to backup data 
prior to downloading data to the computer system. 

Step S90, a final step, is to send data by the detecting 
module 42. After the interface implements a predetermined 
procedure, such as dealing processing with the protocol module 
and the uniform format handling for the received data, the 
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application layer 2 is informed to read access the predetermined 



Hence, if the rccc arr ived data cause damage to the computer 
system, it is capable of returning the storage device to the 
prcccding previous condition state immediately. 

The flow of creating a re store rc at oration point in Step S70 
is to scan the entire disk recognizing the valid data. Each 
re st ore rcst oration point contains the meooage data of which data 
in the disk is valid data . While creating a restore ncw rcotoration 
point, the information of the valid data is stored therein. 

Please be noted that the MSTCP protocol, which is defined 
by the Microsoft, is communicated with the Http/Ftp/Pop3 
application protocols through TDI (Transport Driver Interface) 
layer. In the preferred embodiment of the present invention, the 
detecting module 42 is intercepting network data at a TDI layer. 

The Http/Ftp/Pop3 application protocol sendo transfers data 
to Internet through TdiSendEntry ( ) , the entry function of TDI 
layer, and while Internet sends data back, MSTCP protocol 
produces an event. An event handler function set by 
SetEventEntry () handles this event, TD I _E VENT_RE CE I V . If we 
change the address of the function entry, the function entry of 
TdiSendEntry ( ) and SetEventEntry () , then we can intercept the 
network data . 

When we operate Outlook Express to receive mails, Outlook 
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Express will send a request of receiving mails to the mail server 
on the Internet . All data Outlook Express sent to Internet will 
pass through the TDI layer, and the driver program of the 
backup/ recovery system located in the TP I layer will recognize 
that the user is going to receive mails, and the driver program 
revise the addrcoa entry address of the event returning mails from 
the mail server on the Internet . 

While the received ing mails send back from the mail server , 
system will use event handler function of the_driver program. The 
event handler function handles the data contained in the mails. 
If there are viruses or unoafc dangerous files founded detected 
in the mails, the driver program e-f- at the TDI layer will inform 
the driver program of the backup/ recovery system as per the 
preferred embodiment of the present invention of creating a new 
re st ore root oration point . 

In the preferred embodiment of the present invention, the 
new restore rcotoration point ie— storesd the information of the 
valid data. In the process of backing up data, the data demanded 
needs to be back ed up is stored in the new res tore ro a torat ion 
point . 

After that, the driver program sends the mails to Outlook 
Express. Therefore , ^ if the users read thei^r mails that caused 
the disk being damaged, then the user may might return the disk 
to a otatc of the prcccding previous state. 
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With reference to FIG. 3, according to an embodiment of the 
present invention a backup/recovery system may return the data 
storage device diolc to a otatc of the prcGcding previous state. 
The state A of the hard disk in the computer system is in normal 
conditions. However, the detecting module 42 determines the 
predetermined meooage data is contained a predetermined harmful 
data, and the backup/recovery system creates a restore ncw 
restoration point to backup data. 

Right after that, the detecting module 42 oendo transfers 
the predetermined meooage data to the computer system. The network 
interface implements a predetermined procedure thereafter and 
the application layer 2 involves reading — accessing the 
predetermined meooage data . The user probably downloads a 
virus -infected program, UNKNOWN . EXE , but the user has no idea. 

The predetermined meooage data is with viruses, and the state 
B of the hard disk in the computer system is in abnormal conditions 
Then, viruses are activated and damage the computer syste m is 
damaged , as shown in FIG. 3, the state C of the hard disk in the 
computer system is in destroying conditions. 

Nevertheless, ■£-£— while there is an accident, the user can 
return the disk to a otatc of the prcceding previous state with 
the backup/ recovery system as per the preferred embodiment of the 
present invention. The computer system is easily infected viruses 
while the user downloads data or roads receives mails, but the 
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hard disk is capable of returning the hard disk to a normal state 
due to the backup /recovery system in the preferred embodiment of 
the present invention backs up the valid data being changed otorcd 
in the hard disk prior to downloading data to the computer system. 
Consequently, the system and the programs will never be lost or 
destroyed . 

While this invention has been particularly shown and 
described with reference to embodiments thereof, it will be 
understood by those skilled in the art that various changes in 
form and details may be made therein without departing from the 
spirit and scope of the invention as defined by the appended 
claims . 
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ABSTRACT OF THE DISCLOSURE 

A backup/recovery system and methodology that securely 
backs up and reliably retrieves data in a computer system. 
According to the invention, the backup/ recovery system is 
utilized for protecting the a computer system , having a data 
storage device m cQno , such as a hard disk, with data stored 
thereon, on which data real^ time data backup protection is 
dco requ ired, in order to receive data from network 
oystc m LAN/WAN afterwards without risk . In one embodiment of 
the invention, the backup/ recovery system is installed in the 
computer system. The computer system includes an application 
layer coupled to an interface and operated predetermined 
application programs. A detecting module is located within 
the computer system for monitoring a predetermined mcooagc 
data to be downloaded to the computer system. When the 
predetermined data mcooagc is arreeeived to the computer 
system , the detecting module determines whether there is a 
predetermined harmful data contained in the predetermined 
data mcooagc . If there is a predetermined harmful data 
contained therein, the backup/recovery system backs up data, 
and the interface implements a predetermined procedure 
thereafter, so that application layer can access read the 
predetermined data mcooago safely . 
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